KQL_apt_judgement_panda_gtr19.txt

SecurityEvent | where EventID == "4688" | where (CommandLine contains "\\ldifde.exe -f -n " or CommandLine contains "\\7za.exe a 1.7z " or CommandLine endswith " eprod.ldf" or CommandLine contains "\\aaaa\\procdump64.exe" or CommandLine contains "\\aaaa\\netsess.exe" or CommandLine contains "\\aaaa\\7za.exe" or CommandLine contains "copy .\\1.7z \\" or CommandLine contains "copy \\client\\c$\\aaaa\\" or Image == "C:\Users\Public\7za.exe")